Browse The Skill Store

Scan AI agent skill definitions for malicious instructions, prompt injections, and security risks—locally.

Locally scan your repository for leaked API keys, tokens, and secrets before committing or publishing code.

Automated security audit and health check for software dependencies across polyglot projects.

A professional security triage workflow for mapping attack surfaces and prioritizing DeFi smart contract vulnerabilities.

A rigorous security auditor that scans code for OWASP Top 10 vulnerabilities with severity ratings and concrete fixes.

🔒 PII & Data Leak Scanner

by JustHandled Labs

$15

Scan local SQL, CSV, JSON, seed, fixture, and log files for PII-indicating names plus email-, SSN-, card-, and phone-like values. Get file/line findings with matched values redacted by default—no network, writes, database connection, or compliance claim.

Security Vulnerability Triage Agent for Small Teams

by Shandra

$50

Turns dependency scan reports and security alerts into prioritized remediation plans with severity, exploitability, affected area, safe fix strategy, and verification checklists.

🛡️ Skill Injection Scanner

by JustHandled Labs

$15

Scan a SKILL.md package for prompt injection and secret exfiltration before you install or publish an agent skill. Flags env-variable-to-URL exfiltration wording, conditional triggers with hidden side effects, imperative instructions buried in HTML comments, zero-width characters, base64 and long-token blobs, remote content treated as instructions, pipe-to-shell and recursive force-delete references, and overbroad tool requests (network plus browser plus file-write with no scope).

GDPR Compliance Scanner for Marketing and Code

by Martin Gunderman

$15

Automatically detect GDPR compliance risks in websites, codebases, marketing assets, and AI workflows.

Automate secret scanning with gitleaks — detect API keys, passwords, tokens before incidents.

The security auditor for AI agents. Detect prompt injection, secret leaks, and unsafe tool access in SKILL.md files.

🚀 Launch Readiness Checklist Generator

by JustHandled Labs

$9

Generate a personalized before-you-ship checklist for your app, with the things you already have checked off. Pick your app type (web app, SaaS, store, or content) and it builds a tailored list covering security, legal basics (privacy policy, terms, cookie consent), social preview, payments and refunds, accessibility, analytics, and backups, then scans your repo and pre-checks what is already there. Every item says why it matters in plain English.

📦 Package Supply Chain Sentinel

by JustHandled Labs

$19

Vet dependency changes for supply-chain risk before you install, commit, or release. Scans package and lockfile diffs for install-time lifecycle scripts, non-registry sources, suspicious download commands, typosquatting, and floating versions, across npm, pnpm, yarn, pip, uv, and poetry. Flags what to review with evidence. No install required.

🔳 QR Payload Auditor

by JustHandled Labs

$5

Audit the decoded text a QR code carries before you print it on something. Flags URLs that are not absolute, link shorteners that hide the real destination, unsafe schemes (javascript:, data:, file:), payloads too long to scan reliably, malformed Wi-Fi or contact payloads, and exposed credentials like a Wi-Fi password or a token sitting in a URL. It audits the decoded payload you paste; it does not read images.

Generate source-safe repository audits and repair handoff bundles without mutating your code.

Security Audit & Compliance Toolkit

by Arnstein Larsen

$12.99

A professional-grade toolkit for SAST code reviews, PII scanning, and automated compliance gap analysis.

skill hardening certifier

by Nex AI

$7

A rule-based security scanner and auto-hardener for AI agent skills to detect injections and unsafe code.

Dependency & Supply Chain Risk Gate

by PubsProToolkit

$12

Audit your project's dependencies for supply-chain risk before they ship. Detects the ecosystem, runs the right vulnerability scanners against live advisory data, and adds the checks tooling misses — outdated or abandoned packages, typosquatted or suspicious names, risky install scripts, and license conflicts — then returns a prioritized fix list and a PASS / REVIEW / BLOCK verdict. It's npm audit with triage and judgment on top.

Run a buyer-readiness check before publishing an AI agent skill package.

WordPress Security Code Auditor

by Arnstein Larsen

$27.99

A senior WordPress security auditor that reasons about WP-API taint flow — not regex hits — to find the 8 real plugin/theme vulnerability classes a generic scanner misses, and returns scored findings with ready-to-merge before→after patches.

AI Prompt Injection Defense Shield & LLM Jailbreak Security Auditor Code Review Agent

by Brandon DeVries

Free

Stop leaving your AI startup exposed to malicious users trying to steal your proprietary system prompts or bypass your paywalls. The AI Prompt Injection Defense Shield is an automated code review agent that deeply analyzes your Next.js or Python backend, instantly detecting insecure LLM input fields, un-sanitized API data streams, and weak prompt boundaries. By automatically generating the exact copy-paste code patches required to harden your AI wrapper against the latest OWASP top 10 LLM vulnerabilities, this skill allows solo developers and indie hackers to confidently launch their SaaS without the fear of massive, unexpected API billing spikes or catastrophic data leaks.

⚠️ Model Risk Register Generator

by JustHandled Labs

$12

Generate the model and vendor risk register a security lead asks for the morning after a model gets switched off. It scans your codebase for every model and provider, merges in the owner and data-residency notes you supply, and renders a register with provider, model, where it's used, fallback status, and an availability-risk rating per dependency. Markdown by default, CSV with a flag. Continuity-focused, not a compliance assessment.

linux audit

by SkillBill

$9

Complete security audit for Linux systems and WSL2. Checks kernel CVEs, SSH, firewall, users, and more hardening in one shot.

Specialized static security scanner for MCP servers and Python tool handlers to prevent injection and data leaks.